You don't need root, and you don't need physical access. For Meltdown, you only need the ability to run your own code on the target machine. Where that gets tr

You don't need root, and you don't need physical access. For Meltdown, you only need the ability to run your own code on the target machine. Where that gets tricky is when everyone's using cloud hosting solutions where the physical machines are abstracted away, and a given physical server may be running multiple virtual servers for different customers. Think of it like this: * Somewhere in a data center at a cloud provider is a physical server, wired up in a rack.. * That server runs virtualization software, allowing it to host Virtual Server 1, Virtual Server 2, and Virtual Server 3. * Virtual Server 1 belongs to Customer A. Virtual Servers 2 and 3 belong to Customer B. * Normally, Virtual Server 1 can't access any memory allocated to Virtual Servers 2 and 3. * BUT: Customer A can now use Meltdown to read the entire memory of the physical server. Which includes all the memory space of Virtual Servers 2 and 3, exposing Customer B's data to Customer A. That's the threat here.